CVE-2020-8984

high-risk

Published 2020-03-24

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.

Do I need to act?

0.20% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Zendto

Zend

Third Party Advisory http://jul.es/pipermail/zendto/2020-January/003845.html

Release Notes https://zend.to/changelog.php

Third Party Advisory http://jul.es/pipermail/zendto/2020-January/003845.html

Release Notes https://zend.to/changelog.php

/ 100

high-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 31/34 · Critical